REST API

Authentication

Bearer tokens (sd_live_...) created in the dashboard, with per-token scopes: projects:read/write, deployments:read/write, logs:read, env:read/write, cost:read, billing:read. Rate limits apply per identity; errors return a consistent shape.

{"error": {"code": "forbidden", "message": "..."}}

Endpoints

GET  /api/v1/me                              # token check, org, scopes
GET  /api/v1/projects                        # list projects
POST /api/v1/projects                        # {name, gitRepoUrl?}
GET  /api/v1/projects/:id                    # project detail
DELETE /api/v1/projects/:id                  # unpublish + delete
POST /api/v1/projects/:id/analyze            # register analysis, get cost + route
GET  /api/v1/projects/:id/deployments        # list deployments
POST /api/v1/projects/:id/deployments        # deploy (multipart meta + artifact)
GET  /api/v1/deployments/:id                 # status + events
GET  /api/v1/deployments/:id/logs            # logs (?format=text)
GET/POST /api/v1/projects/:id/env            # environment variables
POST /api/v1/cost/estimate                   # standalone cost estimate
GET  /api/v1/billing                         # plan, credits, invoices

Deploy payload

POST deployments takes multipart/form-data: a meta field (JSON with the ProjectAnalysis, trigger, strategy and git info) and an artifact field (tar.gz of the build output, max 100MB). The CLI does this for you; the format is documented so agents and CI can too.